Traditional monitoring approaches can include using a switched port analyzer (SPAN), mirror ports, or terminal access points (TAPs). Such approaches, however, can overwhelm the related monitoring tools. Additionally, separate network tools can attempt to capture application-specific traffic. However, in such scenarios, the application identification and filtering logic commonly depends exclusively on network and transport layer parameters such as source and destination internet protocol (IP) addresses, source and destination ports, protocol and virtual local area network (VLAN) tags.